H.323 is a standard for packet switched multimedia communications. The standard provides for terminals that allow for any combination of multimedia communications, i.e., bi-directional audio and/or video and/or data communications. H.323 terminals include IP telephones or IP softphones. An IP telephone provides communications capability the same as analog or digital telephones provide except that communications are routed via the IP trunk card to the packet switched network rather than via an analog or digital trunk line. An IP softphone is a client-based telephony application for the desktop PC or laptop that has similar functionality as a desktop IP telephone.
The H.323 standard discusses the functionality required for interoperability between H.323 terminals and other ITU (International Telecommunications Union) standard terminals, including H.320 terminals operating on narrowband ISDN, H.321 terminals operating on broadband ISDN, H.322 terminals operating on ISOEthernet and H.310 terminals operating on asynchronous transfer mode (ATM). The H.323 standard provides for four functional units that may reside in a co-located system. Terminals are a first unit. A second unit, gateways, connects terminals on IP and circuit switched networks (ISOEthernet and ATM are virtual circuit switched networks). A third unit, gatekeepers, provides address resolution, registration of endpoints, admission control, monitor network resources and bandwidth, and maintain data integrity. The fourth unit, multipoint control units (MCU's), is designed to support multiparty conferencing.
A public branch exchange (PBX) is a telephone system that supports an enterprise (college, government office, business, etc.) to switch telephone calls between users within the enterprise. All enterprise users share external telephone lines, i.e., trunk lines, which saves the cost of requiring a line for each user to the telephone company's central office. PBXs have evolved from being proprietary hardware/software systems completely separate from the packet switched network to systems running on servers (now known as telephony servers or application servers), interoperable with other application servers through open standards and operating with the data network. Furthermore, application servers have evolved from strictly routing local and long distance telephone calls over the public switched telephone network (PSTN) to additionally providing the capability to route local and long distance telephone calls over packet switched data networks. These application servers operating on packet switched networks allow the enterprise to reduce costs by maintaining one network instead of two (the data and telephone) and reducing charges from toll calls by routing some calls over the packet switched network.
H.225.0 defines the call signaling (communications) protocol between a H.323 terminal and gatekeeper to perform the functions of registration, admission and status. The Registration, Admission and Status protocol (RAS) facilities the gatekeeper's management over H.323 endpoints (terminal, gateway, gatekeeper and MCU's) and their request for service. RAS uses an unreliable delivery mechanism, the User Datagram Protocol (UDP), which just makes a best effort to deliver data packets. Hence, there is a need to address the integrity of data within RAS packets and authentication of endpoints. H.225.0 defines the RAS protocol and provides security options for adding security to H.323 endpoints, such as, including authentication of endpoints, data integrity to ensure the packet data is not corrupted while in transit and privacy via data encryption.
Encryption and authentication of any form of communication may use either symmetric or asymmetric cryptography. With symmetric cryptography, a secret key is shared between two or more entities and typically is significantly longer than a PIN, password, or pass-phrase. This key is used to encrypt or sign messages sent by one entity and to decrypt or authenticate the signature of the received messages. In asymmetric cryptography, entities use one key (a private key), to encrypt or sign messages, and a second key (public key) is used to decrypt or authenticate the signature of the message.
H.225.0 RAS protocol supports various methods to allow the gatekeeper and endpoint to exchange messages and define the key exchange method used to initiate the call session. There are of course many ways to exchange keys. The key may be provided out-of-band, such as, manually administering a key in each particular host during manufacture or administration, or keys are sent between two endpoints via a local link. Alternatively, there are several well-known key management protocols, such as Rivest-Shamir-Adleman (RSA), Diffie-Hellman, Oakley, and Internet Security Association and Key Management Protocol (ISAKMP), Encrypted Key Exchange, Derived Unique Key per Transaction (DUKPT) and Kerberos. The first six key management schemes operate between 2 entities whereas the Kerberos scheme operates between 3 or more entities. Unfortunately, these seven well known key management protocols require either public key cryptography or pre-administration of a strong shared secret key during the registration process.
For example, authentication schemes for networked terminals, such as, Point of Sale Pinpad and Signature terminals use the DUKPT (derived unique key per transaction) method. The DUKPT method of key derivation is currently used by most Pinpad manufacturers and ATM machines. DUKPT is a key generation method where a large number of distributed terminals, such as, Point of Sale Pinpad and Signature terminals communicate with a central controller. A shared master secret key is stored in the controller and in the Point of Sale Pinpad or Signature terminal during the manufacturing or initial administration process. Thereafter, the Point of Sale Pinpad or Signature terminal and controller derive a transaction key for each communication which is calculated from the shared master key and non-secret transaction information, such as the terminal identification, transaction number and customer transaction information. All of this information, except for the customer's personal identification number (PIN), is sent in clear text. DUKPT provides protection such that knowledge of the key used in a previous transaction does not compromise future transactions. Unfortunately, DUKPT requires the preadministration of a secret key for all devices on the network.
FIG. 1A is an example of the current H.225.0 RAS registration method. At least one telephone system, the Avaya Communication Manager 10 (ACM) embeds the functions of the gateway and gatekeeper using software although such H.323 functionality could reside on separate servers. Alternatively, the functions of the gateway and gatekeeper can be performed by hardware or firmware. The ACM is an application server 10 as it requires an endpoint to authenticate itself before it can receive services as would be the case for packet switched devices, 16, 17 or other computer on an enterprise network.
The ACM 10 has a processor 6 and memory 7 which manages the switching of the calls within the ACM 10 and inbound and outbound calls. ACM 10 communicates via a packet switched network to H.323 terminals, such as, IP telephones 17 or IP softphones 16. Similarly, ACM 10 supports any other packet switched device that incorporates the H.323 terminal functionality, such as, a cell phone with IP telephony capability, wireless handset with IP telephony capability, or PDA with IP telephony capability.
ACM 10 also supports legacy analog and digital phones and facsimile machines via analog or digital station cards 2. An analog station card 2, or otherwise known as an analog port board, provides the support for the legacy analog telephones and facsimile machines. While a digital station card 2, or otherwise known as digital port board, provides the support for digital or ISDN desktop telephones.
Telephone calls can be routed over the PSTN using the analog or ISDN trunk boards 1 or over the local LAN using the IP trunk card 9 and LAN card 15. If calls are routed over the Internet 12, the messages are sent via the router 11.
The ACM hard disk-drive 5 stores the call processing and maintenance software; software to allow for administration either via the web or at an administrator's terminal using a graphical user interface or command line interface; configuration and user administered data, such as, extensions and user PINs; and software to perform the functions of a gatekeeper including RAS registration and software to perform the functions of the gateway.
Hardware and software on resource boards 3 provide resources such as dual tone multi-frequency (DTMF), tone generation, etc. Hardware and software on digital signal processing boards 14 provide resources for voice compression/decompression and packetization/depacketization of voice signals.
FIG. 1B shows the ACM 10 general registration scheme to register packet switched devices 16, 17. ACM 10 uses a H.323 challenge/response RAS procedure to authenticate the packet switched device 16, 17. Communication in the RAS channel is mostly in clear text except for the challenge strings that are specifically encrypted. The RAS procedure follows the general sequence:
In step 11, ACM 10 administration of the packet switched device 16, 17 includes administering the extension of each packet switched device 16, 17 and the extension's associated PIN. As part of the registration procedure, the packet switched device 16, 17 connects to an ACM 10 RAS (registration, admission, status) port previously configured on the packet switched device 16, 17. The packet switched device 16, 17 sends an H.323 gatekeeper request message, GRQ, with the packet switched device's 16, 17 extension as part of the message.
In step 12, the ACM 10 searches for the extension in the configuration data and finds the administered PIN for that extension. The ACM 10 uses a random number to build a challenge string of digits that is valid for a short period of time so that the packet switched device 16, 17 can not resend an earlier registration request message (or otherwise known as RRQ). The ACM 10 sends this challenge as part of a gatekeeper confirm message, GCF, to the packet switched device 16, 17. The ACM 10 performs the same computation the endpoint is performing.
In step 13, when the packet switched device 16, 17 receives the GCF message, the packet switched device encrypts the challenge string with a key derived from the packet switched device's PIN. The packet switched device 16, 17 computes the response to the challenge string using the PIN and sends the computed response as the result to the ACM 10.
In step 14, the ACM 10 verifies the response it received from the packet switched device 16, 17 is the same as the computed response in step 12. If correct, ACM 10 proceeds with the registration of the packet switched device 16, 17.
As is evident, the challenge string of digits is encrypted using a very weak key, the user's PIN, which is at most usually 4-8 digits. An intruder in the network may easily guess the user's PIN. Additionally, the intruder may easily try all possible PIN combinations to find the PIN that produces the same response for a particular challenge. Furthermore, the information sent between the ACM 10 and packet switched devices 16, 17 is in clear text except for the encrypted challenge string in the message. Even after the packet switched device 16, 17 is registered with the ACM 10, the information sent via the H.225.0 call-signaling channel between the packet switched device 16, 17 and ACM 10 is in clear text. Hence, unsecure communications over the communication channel may compromise information such as credit card numbers when sent via a packet switched device 16, 17. Similarly, the weak key does not ensure proprietary information such as file downloads to the packet switched device 16, 17 or user administrative settings, such as, telephone settings remain private and/or authenticated.